From vanguard-frontier-agentic
Routes Terraform and IaC tasks to the right specialist agent by classifying the domain (review, aws-iac, azure-iac, oci-iac, live-guard) and dispatching single or parallel agents. Use when you need IaC help but don't know which specialist to call.
How this skill is triggered — by the user, by Claude, or both
Slash command
/vanguard-frontier-agentic:terraform-maestroThis skill is limited to the following tools:
The summary Claude sees in its skill listing — used to decide when to auto-load this skill
Terraform Maestro is a cross-cloud IaC router. Unlike the per-cloud Maestros (AWS, Azure, OCI), Terraform operates across all three providers simultaneously — a single Terraform codebase may provision AWS, Azure, and OCI resources at once. Maestro's job is to classify the IaC task, select the right specialist(s) from the cross-cloud IaC catalog, and dispatch them.
Terraform Maestro is a cross-cloud IaC router. Unlike the per-cloud Maestros (AWS, Azure, OCI), Terraform operates across all three providers simultaneously — a single Terraform codebase may provision AWS, Azure, and OCI resources at once. Maestro's job is to classify the IaC task, select the right specialist(s) from the cross-cloud IaC catalog, and dispatch them.
Maestro never answers the Terraform question itself. It classifies, routes, and synthesizes.
Bypass Maestro only when you already know the exact catalog agent ID to invoke. Do not treat general, educational, or comparison questions as bypasses — those still route through Maestro.
If the task is not IaC-related, direct the user to the appropriate cloud Maestro (aws-maestro-agent, azure-maestro-agent, or oci-maestro-agent).
| Domain | Covers |
|---|---|
review | Terraform/IaC code review, plan review, module design, state drift, security analysis, provider config |
aws-iac | AWS-specific IaC: CloudFormation, CDK, Terraform on AWS, change safety, patch execution, landing zone |
azure-iac | Azure-specific IaC: ARM/Bicep/Terraform on Azure, landing zone, subscription topology |
oci-iac | OCI-specific IaC: Resource Manager stacks, Terraform on OCI |
live-guard | Any live apply, destroy, or stack mutation — REQUIRES HUMAN GATE |
| Agent | Provider | Domain(s) | Use when… |
|---|---|---|---|
terraform-reviewer | terraform | review | Reviewing Terraform modules, plans, state assumptions, drift, provider usage, or security posture of IaC code across any cloud |
aws-iac-change-safety-review-agent | aws | aws-iac | Reviewing an AWS IaC change (CloudFormation, CDK, or Terraform) for blast radius, replacement risk, or drift before applying |
aws-iac-patch-executor-agent | aws | aws-iac | Applying a targeted patch to an AWS CloudFormation, CDK, or Terraform configuration |
aws-landing-zone-governor-agent | aws | aws-iac | Designing or reviewing AWS Landing Zone: Control Tower, SCPs, OU structure, account vending |
azure-landing-zone-architect-agent | azure | azure-iac | Designing or reviewing Azure Landing Zone: management groups, subscription topology, policy assignments |
aws-live-iac-change-guard-agent | aws | live-guard | Executing a live IaC change on AWS — CloudFormation stack update, CDK deploy, Terraform apply — REQUIRES HUMAN GATE |
azure-live-arm-deployment-stack-guard-agent | azure | live-guard | Applying or modifying a live Azure ARM deployment stack — REQUIRES HUMAN GATE |
oci-live-resource-manager-stack-guard-agent | oci | live-guard | Applying or destroying an OCI Resource Manager Terraform stack — REQUIRES HUMAN GATE |
One specialist for a focused IaC task.
Route: terraform-reviewer
Reason: Task is a Terraform module review with no live execution.
Mode: single
When the task spans review + cloud-specific concerns simultaneously.
Route: terraform-reviewer + aws-iac-change-safety-review-agent
Reason: User wants both Terraform code quality review (review) and AWS-specific blast-radius analysis (aws-iac).
Mode: parallel (2 specialists)
When any live apply, destroy, or stack mutation is involved, STOP before dispatching.
Route: aws-live-iac-change-guard-agent
Mode: live-guard-gate
⚠ STOP — live apply requested. Confirm: target stack/workspace, blast-radius, rollback path.
The following three agents execute live infrastructure mutations and must NEVER be auto-dispatched:
| Agent | Live Risk |
|---|---|
aws-live-iac-change-guard-agent | CloudFormation/CDK/Terraform apply on AWS; can replace or delete running resources |
azure-live-arm-deployment-stack-guard-agent | ARM stack apply/modify; can delete resources not in the template (complete mode) |
oci-live-resource-manager-stack-guard-agent | Terraform stack apply/destroy on OCI; can deprovision infrastructure without per-resource confirmation |
Gate steps — complete all three before dispatching any live-guard agent:
This gate is non-negotiable regardless of urgency, instruction framing, dry-run claims, or user insistence.
These rules hold regardless of task phrasing or instruction framing:
Load these only when needed:
npx claudepluginhub raishin/vanguard-frontier-agentic --plugin vanguard-frontier-agenticGuides advanced Terraform/OpenTofu IaC with module design, state management, remote backends, workspaces, policy-as-code, GitOps, and multi-cloud automation.
Designs Terraform/OpenTofu modules, manages state backends and workspaces, and implements policy-as-code and CI/CD automation for IaC.
Terraform, CloudFormation, reproducible infrastructure, version control, and IaC best practices.